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SELECT A LARGE PRIME p, AND 
GROUPS G 1 AND G 2 OF ORDER p THAT ARE 
EQUIPPED WITH A BILINEAR PAIRING e 
SUCH THAT e: G 1 xG 1 -> G 2 
(E.G., SELECT AN APPROPRIATE CURVE E 

OVER A FIELD F q SUCH THAT 
E (F q ) HAS A SUBGROUP G 1 OF ORDER p, 
WHERE e IS THE TATE OR WEIL PAIRING 
FROM G 1 x G 1 TO A GROUP G 2 OF ORDER p) 
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SELECT A GENERATOR gGG 1 
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CONSTRUCT A DESCRIPTION OF 
p, e, G 1( G 2 , AND g 
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PERFORM CURVE SETUP TO OBTAIN p, e, G v G 2 , AND g 



y_ 

SELECT A RANDOM MASTER SECRET a (I.E., AN INTEGER aeZ p *) 



j 

COMPUTE g CT 
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SELECT A CRYPTOGRAPHIC HASH FUNCTION H 0 THAT MAPS 
ARBITRARY IDENTITY STRINGS (ID A , ID B , ETC.) TO ELEMENTS OF G/ 



SELECT A CRYPTOGRAPHIC HASH FUNCTION H 1 THAT MAPS PAIRS 
COMPOSED OF AN ELEMENT OF G,* AND AN ARBITRARY 
STRING (E.G., A MESSAGE M) TO ELEMENTS OF Z p * 



1 f 



SELECT A CRYPTOGRAPHIC HASH FUNCTION H 2 THAT MAPS 
ELEMENTS OF G 2 * TO BIT-STRINGS OF SOME FIXED LENGTH K, 
WHERE K CORRESPONDS TO THE SYMMETRIC KEY LENGTH OF 

A SYMMETRIC CIPHER 



SELECT A CRYPTOGRAPHIC HASH FUNCTION H 3 THAT MAPS 
ELEMENTS OF G 2 * TO ELEMENTS OF Z p * 



y 

PUBLISH A DESCRIPTION OF THE PUBLIC PARAMETERS 
P. e, G 1f G 2 , g, g G , H 0 , H 1f H 2> AND H 3 
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MAINTAIN DESCRIPTION OF THE MASTER SECRET a 
AS A SECRET 
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RECEIVE PRIVATE KEY REQUEST 
FOR IDENTITY ID 
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AUTHENTICATE REQUEST 




r 



GENERATE PRIVATE KEY SK THAT 
CORRESPONDS TO IDENTITY ID 
USING PUBLIC PARAMETERS 

AND MASTER SECRET 
(I.E., COMPUTE SK = [H 0 (ID)]°) 



PROVIDE SKTO REQUESTER 
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PERFORM SIGNCRYPTION SETUP 
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SENDER A OBTAINS IBE PRIVATE KEY SK A 
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SENDER A SIGNS AND ENCRYPTS A MESSAGE M 
TO CREATE A SIGNED AND ENCRYPTED 
VERSION OF MESSAGE M CALLED C 
(A USES IBE PUBLIC KEY OF RECIPIENT B AND As 
IBE PRIVATE KEY SK A ) 



SENDER A SENDS C TO RECIPIENT B ANONYMOUSLY 



RECIPIENT B RECEIVES SIGNED AND ENCRYPTED MESSAGE C 



RECIPIENT B OBTAINS IBE PRIVATE KEY SK, 
AND IBE PUBLIC PARAMETERS 



B 



RECIPIENT B DECRYPTS C TO PRODUCE IDENTITY OF 
SENDER A (ID A ), UNENCRYPTED MESSAGE M, AND 
IBE SIGNATURE OF M BY SENDER A (SIG A (M)) 



64 



B VERIFIES SIG A (M) 
TO PROVE THAT A SIGNED M 
AND TO VERIFY FOR B 
(AND ONLY B) THAT 
A CREATED C 



B PROVIDES ID A , M, AND SIG A (M) 
TO A THIRD PARTY J 



J VERIFIES SIG A (M) TO PROVE 
THAT A SIGNED M 
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COMPUTE COMMITMENT i = [H n (ID A )l r 
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COMPUTE DIGEST h = H 1 (J | M) 
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COMPUTE DECOMMITMENT v = rSKJ r+h 
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COMPUTE SIGNED MESSAGE SIG A (M) = M 1 i v 
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COMPUTE SHARED SECRET u = e (SK» H„(ID D )) 
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COMPUTE HASH OF SHARED SECRET k = Hofu) 


ft 


88 


COMPUTE BLINDED COMMITMENT x = j k 
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COMPUTE SYMMETRIC SESSION KEY w = H 2 (u K r ) 








COMPUTE Y = ENCRYPT W (ID A | v |M) 
(I.E., ENCRYPT ID A |v |M using w) 
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COMPUTE C = x|y 
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SEND C TO RECIPIENT 
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RECEIVE C FROM SENDER A 



OBTAIN IBE PRIVATE KEY OF 
RECIPIENT SK R 



COMPUTE SYMMETRIC SESSION KEY 
w = H 2 (e(x, H 0 (ID B ))) 



j 

COMPUTE [ ID A | v | M ] = DECRYPT W (y) 
TO PRODUCE ID A , v , AND M 



COMPUTE SHARED SECRET 
u = e(H 0 (ID A ), SK B ) 



COMPUTE HASH OF SHARED SECRET 
k=H 3 (u) 



COMPUTE COMMITMENT J = x 1/ k 



SEND ID A , M, j, AND vTO 
THIRD-PARTY J AND RETAIN 
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OBTAIN ID A , M, j, v 
(E.G., DECRYPT C TO PRODUCE 
THESE VALUES OR RECEIVE 
THIS INFORMATION FROM 
PARTY WHO DECRYPTED C) 



COMPUTE HASH OF COMMITMENT 
CONCATENATED WITH MESSAGE 
h = ^ (j|M) 



COMPARE e (g,v) AND e(g CT , H 0 (I D A ) ■ j ) 
TO DETERMINE WHETHER A SIGNED M 
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